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WHAT IS CLAIMED IS: 
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A method for recording network usage, the method comprising tye , steps 

defining a network data collector including an encapsulated, an 
aggregator, and a data storage system; 

receiving a set of network accounting data via the^ncapsulator; 

converting the network accounting data set to^a standard data format; 

processing the network accounting data sefvia the aggregator, including 
the steps of defining a rule chabf and applying the rule chain to 
the network accounting data/Set to construct an aggregation tree 
including creating an agg?4gated network accounting data set; and 

storing the aggregated netwoj^c accounting data set in the data storage 
system. 
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2. The method of claims, wherein the step of applying the rule chain to the 
network accounting data^et to construct the aggregation tree includes the step of 
applying a rule from t^e rule chain to the network accounting data set to define a 
group node. 



3. 



The method of claim 2, wherein the rule is a match rule. 



le method of claim 1 , wherein the step of applying the rule chain to the 
25 network accounting data set to construct the aggregation tree includes the step of 
applying a set of match rules to the network accounting data set to define a 
ferarchy of group nodes within the aggregation tree. 

5. The method of claim 4, wherein the step of applying the rule chain to the 
(0 network accounting data set to construct the aggregation tree includes the step of 
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applying an aggregation rule to the match group node to create the aggregated ^ 
network accounting data set. / - 

6. The method of claim 1, wherein the step of applying the ruleehain to the 
network accounting data set to construct the aggregation tree inchraes the step of 
applying a data manipulation rule to the network accounting data set. 

7. The method of claim 6, further comprising the s^ep of defining the data 
manipulation rule to be an adornment rule. / 

8. The method of claim 6, further comprising the step of defining the data 
manipulation rule to be a filtering rule. / 

9. The method of claim 1 , wherein the network accounting data set is a set 
of session data. / 

10. The method of clairr/l , wherein the network accounting data set is a set 
of usage data. / 

1 1 . The method/of claim 1, further comprising the step of defining a data 
flush interval; ai*Q wherein the step of storing the aggregated network accounting 
data set incluffcs the step of transferring the aggregated network accounting data 
to the datastorage system after a period of time associated with the data flush 
interval/ 

12: The method of claim 1 , further comprising the step of defining a rule 
within the rule chain by a Java object class, and allowing additional rule types to 
be added to the rule chain corresponding to the Java object class. 



41 




PATENT 
PDNO 10002142 



ru 



10 



15 



13. A method for recording network usage including correlating of network 
usage information and network session information, the method comprising the 
steps of: 

defining a network data correlator collector includin^h encapsulator, an 

aggregator, and a data storage system; 
receiving a set of network session data via the enfcapsulator; 
processing the network session data set via th^aggregator, including the 
steps of defining a first rule chain a^d applying the first rule chain 
to the network session data to construct an aggregation tree; 
receiving a set of network usage data^via the encapsulator; 
processing the network usage data/Set via the aggregator, including the 

steps of defining a secoiafa rule chain and applying the second rule 
chain to the network olsage data and the aggregation tree to 
construct a correlated aggregation tree; 
determining a correlat^ data set from the correlated aggregation tree; 
and 

storing the correlated data set in the data storage system. 



14. The methoclof claim 13, wherein the network session data set is in a 
20 standard data format received from a session data collector having an 

encapsulator, an aggregator and a data storage system. 

15. TJfe method of claim 14, wherein the network usage data set is in the 
standard data format received from a usage data collector having an 

25 encapsulator, an aggregator and a data storage system 



16. The method of claim 13, further comprising the step of defining the first 
rule set to be different than the second rule set. 



30 17. A method for recording network usage comprising the steps of: 
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defining a first network data collector including a first encapsulator. 

first aggregator, and a first data storage system; 
receiving a first set of network data via the first encapsulator;, 
processing the first network data set via the first aggregator/ including the 

steps of defining an aggregation rule chain and determining a first 

set of aggregated data by applying the aggregation rule chain to 

the first set of network data; and 
storing the first aggregated network data set in t\y6 first data storage 

system. 

1 8. The method of claim of claim 1 7, where^i the step of applying the 
aggregation rule chain to the first set of network data further comprises the steps 
of: 

constructing an aggregation treof and 

determining the first aggreg^ed network data set from the aggregation 
tree. 



1 9. The method of clahai 1 8, wherein the step of constructing an aggregation 
tree further includes th^steps of: 
20 defining the first network data set to includes a first network data event 

and^a second network data event; 
applying/the aggregation rule chain to the first network data event to 

construct a hierarchy of group nodes within the aggregation tree; 
and 

25 ^plying the aggregation rule chain to the second network data event to 

locate similar group nodes according to a predefined set of match 
rules, if no matching group nodes exist, extending the hierarchy 
of group nodes within the aggregation tree by creating additional 
group nodes. 
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20. The method of claim 19, wherein the step of applying the aggregation 
rule chain to the first network data event further includes the steps of 

defining the aggregation rule chain to include a first matcja / rule for 
matching source IP address; 

defining the first network data event to include a firtft source IP address; 

applying the first match rule to the first networl^data event, including 
determining whether the aggregation l?fee includes a first group 
node matching the first source IP address; and if a matching first 
group node does not exist, cre^tmg the first group node for the 
first source EP address. 
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21. The method of claim 20, wheifein the step of applying aggregation rule 
chain to the first network data event further includes the steps of: 

defining the aggregation rule chain to include a second match rule for 
1 5 matching destination IP address; 

defining the firstmetwork data event to include a first destination IP 
address; 

applying thfe second match rule to the first network data event, including 
fctermining whether the aggregation tree includes a second group 
20 / node matching the first destination IP address; and if a matching 

second group node does not exist, creating the second group node 
for the first destination IP address. 
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The method of claim 21, wherein the step of applying the aggregation 
rule chain to the first network data event further includes the steps of: 
defining the aggregation rule set to include an aggregation rule; 
defining the first network data event to include a port number and 

volume of information; 
applying the aggregation rule to the first network data event, including 
copying the port number, source EP address, destination IP 
address and volume information to the second group node. 
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23. The method of claim 17, further comprising the steps of: 

defining a second network data collector including a secoru; 

encapsulator, a second aggregator, and a second ^ata storage 
system; 

receiving a second set of network data via the second network 
encapsulator; 

processing the second network data set via the/feecond aggregator, 

including the steps of defining a second rule chain and applying 
the second rule chain to the second set of network data to define a 
second set of aggregated network data; and 

storing the second aggregated network data set in the second data storage 
system. 



15 24. A network usage recording^ystem having a network data collector, the 
network data collector comprisir 

an encapsulator for receiving a set of network accounting data and 

converting tlje network accounting data set to a standard data 
format; 

20 an aggregator fof processing the network accounting data set, the 

aggregator including a defined rule chain, wherein the aggregator 
applies the rule chain to the network accounting data set to 
construct an aggregation tree, and determines a set of aggregated 
/network accounting data from the aggregation tree; and 
25 a da& storage system for storing the aggregated network accounting data. 

25. Ahe system of claim 24, wherein the process of applying the rule chain to 
the r^twork accounting data performs data reduction on the network data. 

16. A network usage recording system having a network data correlator 
collector, the network data correlator collector comprising: 
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an encapsulator which receives a set of network session data; 

an aggregator for processing the network session data set, the^aggregator 
including a defined first rule chain, wherein the aggregator 
applies the first rule chain to the network sessiorf'data set to 
construct an aggregation tree; / 

wherein the encapsulator receives a set of networkaxsage data, and the 
aggregator processes the network usage/flata set, the aggregator 
including a defined second rule chain; wherein the aggregator 
applies the second rule chain to the network usage data set and 
the aggregation tree to construct a correlated aggregation tree, and 
determines a correlated data^set from the correlated aggregation 
tree; and 

a data storage system for stonng the correlated data set. 
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1 5 27. The system of claim 26, wherein the network session data set is in a 
standard data format receiyed from a session data collector having an 
encapsulator, an aggregator and a data storage system. 

28. The systenVof claim 27, wherein the network usage data set is in the 
20 standard data foirnat received from a usage data collector having an 
encapsulator/an aggregator and a data storage system. 
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29. /The system of claim 26, further wherein the first rule set is different than 
the second rule set. 
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